f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a

Analysis

max time kernel
37s
max time network
74s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 13:34

Target

f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe
Size

293KB
MD5

9bbf67a2764a1cc671163a110e5e0f0e
SHA1

23f0a074fe0a561764d2e3189099687eb94c36c7
SHA256

f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a
SHA512

7a11b52d431468f9aeefdf17892a00e20d16df50d8386b59f65b68b71e6a99a3016d0189be632c4d2cd9ee48660739e9181f095b3d1bc0814b0672a335d81786
SSDEEP

6144:PrkH9uEo2S1YnQmCX492DkwNP3qpYFkSJEw8NFPbNeIfV+iqhwpCIoDF:Prkdu6/eIo4/PPbNNfV+iUwpCPh

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
1348	f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe
1348	f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe
1348	f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe
"C:\Users\Admin\AppData\Local\Temp\f794d8d29fb5f57750c15775b3026ce595b53b2eb38d98e6d3e2a6ca1bbbed1a.exe"
1⤵
- Loads dropped DLL
PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\TsuAB1A4DBD.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{D3A60A45-79CA-4351-A1BA-31E8084528B3}\Custom.dll

Filesize
66KB

MD5
da2373d58c5519642847863bb056d862

SHA1
6cf6e5b5757dec9763317a3e1c5326408c96ce86

SHA256
87d0622e84a8ef4777ff36e3804487e9aef738d4a91601d2a6608d59c91f9e3c

SHA512
f06f2931b7129bfbd813858c5ed02932de8388ee497cae97deab674739eb81ebde278c8f373780eed1cef9723b60747501ebb966d40e9b40c864b206490956b0

Download Submit
\Users\Admin\AppData\Local\Temp\{D3A60A45-79CA-4351-A1BA-31E8084528B3}\_Setup.dll

Filesize
160KB

MD5
3d99f53c75ee301fd7bc5abe8d883dbb

SHA1
35264d2ed3c675f152ac54045ce817693234fe06

SHA256
4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

SHA512
a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

Download Submit
memory/1348-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download